This picture is indeed consistent with the extensive empirical evidence for neural networks. A random perturbation avoids adversarial “raisins” [1]}, yet they are easy to find by targeted optimization methods such as PCG [2]}. I should point out that there are also other explanations for adversarial examples [3]}. It seems plausible that several mathematical effects combine to produce adversarial examples.
